Security Incident at EHR Vendor Affects Patients of New York Counselling Practices
Hispanic Counseling Center and Brooklyn Counseling Services in New York have notified patients that some of their personal and health information was compromised in a data security incident at their electronic medical record vendor.
Hispanic Counseling Center
Long Island, New York-based Hispanic Counseling Center operates a mental health clinic and a substance use disorder clinic and provides bilingual counselling services. According to recently mailed notification letters, its electronic medical record vendor, Accumedic Computer Systems, informed Hispanic Counseling Center that it detected suspicious activity within its network on June 8, 2026.
Third-party cybersecurity experts were engaged to investigate the activity, and on August 7, 2026, the EHR vendor concluded that an unauthorized third party first accessed the Accumedic Computer Systems network on April 8, 2026, and potentially obtained customer information between June 4, 2026, and June 8, 2026. The impacted data was reviewed, and on September 1, 2026, Accumedic Computer Systems confirmed that patient health information had been exposed and was potentially obtained. The types of data involved included names, dates of birth, Social Security numbers, medical information, and health insurance information.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
The EHR vendor has confirmed that additional technical safeguards have been implemented to prevent similar incidents in the future. Hispanic Counseling Center started notifying the affected individuals on October 30, 2026. The notification letters state that complimentary credit monitoring services are available to the affected individuals. The number of affected individuals has not been publicly disclosed as of the date of this article.
Brooklyn Counseling Services
Brooklyn Counseling Services, a Brooklyn, New York-based provider of psychological and emotional care and support, has also notified certain patients about a recent security incident that exposed some of their personal data. The company, which operates formally as BCS Group and is also known as BCS Counselling Group, said the incident affected one of its electronic medical records vendors.
State Attorneys general have been notified about the incident; however, the total number of affected individuals has yet to be publicly disclosed. The incident affected one Massachusetts resident and two Vermont residents; however, the vast majority of individuals are likely to reside in Brooklyn, and the New York Attorney General does not publicly disclose the number of individuals affected by data breaches.
The individual notification letters state the types of information involved for each individual, which include names, email addresses, phone numbers, dates of birth, Social Security Numbers, and health records. The breach notification letter seen by The HIPAA Journal does not state when the incident occurred and does not name the vendor; however, the timing of the letters suggests the incident involved the same vendor, Accumedic Computer Systems, which offers EHR software specifically for behavioral health services providers.
